AI plugins for Obsidian
Capabilities and risks in 2026

Open the original text of the fixed commit

75: 
76: | Model source                | How access works                                               | Who processes the prompt                                        |
77: | --------------------------- | -------------------------------------------------------------- | --------------------------------------------------------------- |
78: | **Copilot-hosted**          | Lite, Plus, or included Supporter access                       | Brevilabs and the enterprise model provider used for that model |
79: | **Cloud BYOK**              | Your API key under BYOK                                        | The provider and endpoint you configured                        |
80: | **Local BYOK**              | Ollama, LM Studio, or another local OpenAI-compatible endpoint | Your local endpoint                                             |
81: | **opencode-reported model** | Authentication managed by opencode                             | The provider behind that opencode model                         |
82: | **Claude**                  | Claude Code login or environment                               | Anthropic under your Claude account                             |
83: | **Codex**                   | Codex CLI login through `codex-acp`                            | OpenAI under your Codex or ChatGPT account                      |
84: 
85: A Claude or ChatGPT subscription is not an API key. Use the Claude or Codex Agent Chat setup for those subscriptions. Use BYOK only when you have API access or an OpenAI-compatible endpoint.
86: 
87: ## Understand service data routes
88: 
89: The selected model is only one possible route. A feature may call another service for the part of the task you asked it to perform:
90: 
91: - A **Copilot-hosted Skill** sends the search query, URL, or document needed by that Skill to Brevilabs.
92: - **Plus document processing** sends the supported document to Copilot's hosted processor.
93: - In **Agent Chat**, **Miyo document processing** runs through the local Miyo CLI, so PDF and EPUB parsing stays on this computer even when search uses a remote Miyo server.
94: - In **Quick Chat**, **Miyo document processing** uses the connected Miyo service. A configured remote Miyo server processes the document there rather than on this computer.
95: - Saved **project context** that needs web, YouTube, or binary-file conversion can use Copilot's hosted project service. The Miyo Document Processor choice does not change that project route.
96: - An agent can read a local note and include relevant text in the prompt sent to the selected model. Opening Agent Chat alone does not upload the whole vault.
97: 
98: For a workflow that does not send task content to Brevilabs, use direct Markdown context, local tools or local Miyo, and a local model. Disable Copilot's cloud-backed Skills for every agent you use. Do not add web pages, YouTube links, or binary files as saved project context when their hosted conversion is outside your intended boundary.
99: 
100: The [privacy policy](https://www.obsidiancopilot.com/en/privacy) describes how Copilot's hosted requests are processed. Your model provider and Miyo server have their own boundaries and terms.

Open the original text of the fixed commit

103: 
104: Supporter and eligible legacy licenses can open **Settings → Copilot → Self-Host** and enable **Self-Host Mode**.
105: 
106: When it is on, Copilot:
107: 
108: - Lets you supply Firecrawl, Perplexity, Parallel, or Exa credentials for web search.
109: - With OpenCode selected, routes Agent Chat web searches through that selected provider while keeping its API key inside Obsidian. This does not require Obsidian's command line interface.
110: - Disables OpenCode's native web-search and web-fetch tools so they cannot bypass the selected route. Full-page fetching through OpenCode is unavailable until the self-host providers share a supported fetch interface.
111: - Lets you supply a Supadata key for YouTube transcripts.
112: - Directs you to BYOK for local or self-hosted model endpoints.
113: - Flags and sorts cloud agents and models below local or self-hosted choices.
114: 
115: It does not disable the cloud. Claude, Codex, Copilot-hosted models, cloud BYOK providers, Firecrawl, Perplexity, Parallel, Exa, and Supadata can still send data to their services when you select them. The warnings make those routes visible so you can decide.
116: 
117: You do not need Self-Host Mode to use a local BYOK model or local Miyo. Those are available independently.

Open the original text of the fixed commit

239:   /** Whether the OS keychain is available in this Obsidian version. */
240:   // DESIGN NOTE — intentionally only checks for the `secretStorage` object,
241:   // not individual methods (`getSecret`/`setSecret`/`listSecrets`). Obsidian
242:   // ships SecretStorage as a single API surface (1.11.4); there is no
243:   // released version where the object exists but methods are missing.
244:   // Capability-probing each method would add branching for a partial-API
245:   // world that does not exist. If a future review flags this again, point
246:   // them at this note.
247:   isAvailable(): boolean {
248:     return !!this.app.secretStorage;
249:   }
250: 
251:   /** Get the current vault namespace ID. */
252:   getVaultId(): string {
253:     return this.vaultId;
254:   }
255: 
256:   /**
257:    * Set the vault namespace ID from persisted settings.
258:    * Reason: called during load to replace the path-derived fallback with the
259:    * stable persisted ID, so vault renames don't orphan keychain entries.
260:    */
261:   setVaultId(id: string): void {
262:     this.vaultId = id;
263:   }
264: 
265:   /**
266:    * Access SecretStorage with a runtime guard.
267:    * Reason: replaces scattered non-null assertions with a single guard
268:    * that produces a clear error when keychain is unavailable.
269:    */
270:   private get storage(): SecretStorage {
271:     if (!this.app.secretStorage) {
272:       throw new Error("OS keychain (SecretStorage) is not available.");
273:     }
274:     return this.app.secretStorage;

Open the original text of the fixed commit

144:   async check_for_updates() {
145:     if (await this.is_new_plugin_version(this.manifest.version)) {
146:       // console.log("opening release notes modal");
147:       try {
148:         this.ReleaseNotesView.open(this.app.workspace, this.manifest.version);
149:       } catch (error) {
150:         console.error('Failed to open ReleaseNotesView', error);
151:       }
152:       await this.set_last_known_version(this.manifest.version);
153:     }
154:     window.setTimeout(this.check_for_update.bind(this), 3000);
155:   }
156: 
157:   async check_for_update() {
158:     try {
159:       const { json: response } = await requestUrl({
160:         url: "https://api.github.com/repos/brianpetro/obsidian-smart-connections/releases/latest",
161:         method: "GET",
162:         headers: {
163:           "Content-Type": "application/json",
164:         },
165:         contentType: "application/json",
166:       });
167:       const latest_release = response.tag_name;
168:       if (latest_release !== this.manifest.version) {
169:         if (!this.update_available || this.latest_release_version !== latest_release) {

Open the original text of the fixed commit

4: const DEFAULT_SETTINGS: TextGeneratorSettings = {
5:   version: pkg.version as any,
6:   endpoint: "https://api.openai.com/v1",
7:   models: [],
8:   api_key: "",
9:   encrypt_keys: false,
10:   selectedProvider: "OpenAI Chat (Langchain)",
11:   max_tokens: 5000,
12:   temperature: 0.7,
13:   frequency_penalty: 0.5,
14:   showStatusBar: true,
15:   outputToBlockQuote: false,
16:   freeCursorOnStreaming: false,
17:   allowJavascriptRun: false,
18:   experiment: false,
19:   promptsPath: "textgenerator/templates",
20:   textGenPath: "textgenerator/",
21:   prefix: "\n\n",
22:   tgSelectionLimiter: "^\\*\\*\\*",
23:   stream: true,
24:   context: {
25:     customInstructEnabled: true,
26:     includeClipboard: true,
27:     customInstruct: `Title: {{title}}
28:   
29: Starred Blocks: {{starredBlocks}}
30: 	  
31: {{tg_selection}}`,
32: 
33:     contextTemplate: `Title: {{title}}
34: 	
35: Starred Blocks: {{starredBlocks}}
36: 	  
37: {{tg_selection}}`,
38:   },
39:   requestTimeout: 300000,
40:   options: {

Open the original text of the fixed commit

355:       {},
356:       this.getFrontmatter(this.getMetaData(templatePath)),
357:       contextObj.frontmatter
358:     );
359: 
360:     if (contextOptions.includeClipboard)
361:       try {
362:         blocks["clipboard"] = await this.getClipboard();
363:       } catch {
364:         // empty
365:       }
366: 
367:     const options = {
368:       selection,
369:       selections,
370:       ...blocks["frontmatter"],
371:       ...blocks["headings"],
372:       content: ctnt,
373:       context,
374:       ...blocks,

Open the original text of the fixed commit

664:   encryptAllKeys() {
665:     // check if user have LLMProviderOptionsKeysHashed object (upgrading from older version)
666:     this.settings.LLMProviderOptionsKeysHashed ??= {};
667: 
668:     const keyList: string[] = [];
669: 
670:     this.settings.api_key_encrypted = this.getEncryptedKey(
671:       this.settings.api_key
672:     );
673: 
674:     // get all secret keys
675:     Object.entries(this.settings?.LLMProviderOptions).forEach(([key1, l1]) => {
676:       if (typeof l1 != "object") return;
677:       Object.entries(l1).forEach(([key2, l2]) => {
678:         if (key2.toLowerCase().includes("key") && typeof l2 == "string") {
679:           keyList.push(`${key1}.${key2}`);
680:         }
681:       });
682:     });
683: 
684:     keyList.forEach((pth) => {
685:       const keyval =
686:         (get(this.settings?.LLMProviderOptions, pth) as never as string) || "";
687: 
688:       const encrypted = this.getEncryptedKey(keyval);
689:       this.settings.LLMProviderOptionsKeysHashed[pth] = encrypted;
690:     });
691:   }
692: 
693:   removeApikeys(settings: typeof this.settings): typeof this.settings {
694:     const LLMProviderOptions = JSON.parse(
695:       JSON.stringify(settings?.LLMProviderOptions)
696:     ) as typeof this.settings.LLMProviderOptions;
697: 
698:     // get all secret keys
699:     Object.entries(LLMProviderOptions).forEach(([key1, l1]) => {
700:       if (typeof l1 != "object") return;
701:       Object.entries(l1).forEach(([key2, l2]) => {
702:         if (key2.toLowerCase().includes("key") && typeof l2 == "string") {
703:           set(LLMProviderOptions, `${key1}.${key2}`, "");
704:         }
705:       });
706:     });
707: 
708:     return {
709:       ...settings,
710:       api_key: "",
711:       LLMProviderOptions,
712:     };

Open the original text of the fixed commit

742:   getEncryptedKey(apiKey: string) {
743:     if (!safeStorage?.isEncryptionAvailable() || !this.settings.encrypt_keys) {
744:       return `${DecryptKeyPrefix}${apiKey}`;
745:     }
746: 
747:     return safeStorage.encryptString(apiKey) as Buffer;
748:   }
749: 

Open the original text of the fixed commit

35:   custom_header: true,
36: };
37: 
38: export const DecryptKeyPrefix = "__@#key_prefix#@__";
39: